CVE-2025-68954

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to...

libssh key passphrase bypass without agent set

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent...

libssh global known_hosts override

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

CURL-CVE-2025-15079 libssh global known_hosts override

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

PT-2026-1835

Name of the Vulnerable Software and Affected Versions MicroServer affected versions not specified Description An unused function in MicroServer can initiate a reverse SSH connection to a vendor-registered domain without mutual authentication. An attacker with local network access and administrati...

Cisco UTD SNORT IPS Engine Software和Cisco Secure Firewall Threat Defense Software 资源管理错误漏洞

Cisco UTD SNORT IPS Engine Software and Cisco Secure Firewall Threat Defense Software are both products of Cisco Corporation.Cisco UTD SNORT IPS Engine Software is an intrusion detection and defense Cisco Secure Firewall Threat Defense Software is a firewall operating system. A resource managemen...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000244)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000244 advisory. In the Linux kernel before 4.20.14, expanddownwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NU...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from a memory corruption that occurs when launching a secure application on a device with insufficient memory...

Linux Distros Unpatched Vulnerability : CVE-2025-15224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locall...

CVE-2025-47396

CVE-2025-47396 is a memory corruption vulnerability described across multiple sources as affecting Qualcomm chipsets when a secure application is launched on a device with insufficient memory. The underlying issue is triggered during secure-app startup, with the CVSS data indicating local attack ...

CVE-2025-47396 Double Free in Graphics

Memory corruption occurs when a secure application is launched on a device with insufficient memory...

CVE-2025-47396 Double Free in Graphics

Memory corruption occurs when a secure application is launched on a device with insufficient memory...

CVE-2025-47346

CVE-2025-47346 describes memory corruption when processing a secure logging command in the trusted application on Qualcomm chipsets. The CVSSv3.1 metrics indicate a local, low-complexity attack with no user interaction, resulting in high confidentiality, integrity, and availability impact (CVSS b...

CVE-2025-47346 Out-of-bounds Write in HLOS

Memory corruption while processing a secure logging command in the trusted application...

CVE-2025-47346 Out-of-bounds Write in HLOS

Memory corruption while processing a secure logging command in the trusted application...

CVE-2025-15382

A heap buffer over-read vulnerability exists in the wolfSSHCleanPath function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte...

CVE-2025-15382 Client SCP Request Triggers Buffer Overread by 1 Byte

A heap buffer over-read vulnerability exists in the wolfSSHCleanPath function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte...

CVE-2025-15382 Client SCP Request Triggers Buffer Overread by 1 Byte

A heap buffer over-read vulnerability exists in the wolfSSHCleanPath function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte...

GHSA-9RG3-9PVR-6P27 MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download

Summary A Path Traversal Zip Slip vulnerability exists in MONAI's downloadfromngcprivate function. The function uses zipfile.ZipFile.extractall without path validation, while other similar download functions in the same codebase properly use the existing safeextractmember function. This appears t...

Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

Summary Pterodactyl does not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions...